Apple fixes 17 Mac OS X flaws
Buffer-overflow vulnerability among those sealed off Thursday
Computerworld - Apple Inc. today unveiled the year's fifth major security update for Mac OS X to patch 17 vulnerabilities, but fewer than one-third of them could lead to hackers injecting their own code into a compromised system.
Today's release also marked the first time this year that an operating system security update from Apple did not patch a vulnerability disclosed by the January Month of Apple Bugs project.
If Apple sorted bugs by a ranking system -- as do other vendors, including Microsoft Corp. -- most of the bugs fixed by Security Update 2007-005 would be rated less than critical. In eight out of the 17, for example, exploits could do no more damage than to generate a denial of service of, or crash, the affected component. Microsoft typically pegs such vulnerabilities as "important" rather than "critical." Only five of the patched vulnerabilities could result in an attacker executing his own code.
Among the serious bugs is one in how Mac OS X 10.4, known as Tiger, handles PDF files. "By enticing a user to open a maliciously crafted PDF file, an attacker could trigger the overflow, which may lead to an unexpected application termination or arbitrary code execution," Apple's advisory said. Attacks sporting this strategy, although rare on Macs, are common threats faced by Windows users, who have had to learn -- sometimes unsuccessfully -- to be wary of unexpected file attachments.
Another dangerous flaw fixed today exists in the code that maps ports on home networks in iChat, Apple's instant messaging service and software. An attacker need only send a malformed packet to trigger a buffer overflow, which could then be used to add malicious code to the Mac. The hacker, however, must have access to the local network to exploit the bug.
Other parts of Mac OS X that were patched today include BIND (Berkeley Internet Name Domain), the de facto standard Domain Name System server software, which was patched against four vulnerabilities; the Ruby CGI library (two vulnerabilities); and Fetchmail (one vulnerability).
Although today's update pushed Apple's year-to-date patch total to over 100, there was a bright side: It included fixes for fewer flaws than last month (25) and the month before (45).
The security update can be downloaded from the Apple site or using Mac OS X's built-in update service.
Read more about Security in Computerworld's Security Topic Center.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts